Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:76568
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.178 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
In-Reply-To: <53EE589F.7030109@sugarcrm.com>
References: <53EA93F0.8090104@sugarcrm.com>
	<CAEZPtU6SJWjdcM7sqzV9ry20uTExd=s97dEjdVk=haJ-2XjVzw@mail.gmail.com>
	<53ED6027.3000704@sugarcrm.com>
	<CAEKnhAHQcWvnNZH6mXLt9J76jD_FuzU2dMuQeU7Zf7d+dfKq9A@mail.gmail.com>
	<53EE589F.7030109@sugarcrm.com>
Date: Fri, 15 Aug 2014 20:18:48 +0100
Message-ID: <CAEKnhAH6DTdp5puy-3O4+g1kFE2XL3EdOmkoH2GwkruJNAimdw@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Pierre Joye <pierre.php@gmail.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=90e6ba6e89b80279000500afe4e9
Subject: Re: [PHP-DEV] Re: glob() bug 47358
From: bukka@php.net (Jakub Zelenka)

--90e6ba6e89b80279000500afe4e9
Content-Type: text/plain; charset=UTF-8

Hi,

On Fri, Aug 15, 2014 at 7:59 PM, Stas Malyshev <smalyshev@sugarcrm.com>
wrote:

> Hi!
>
> > The source of the problem is that the open_basedir will always leek
> > information about dirs that the user is not suppose to see (out of the
> > open_basedir restriction). The reason is that false value can indicate
> > that (more info in the PR or https://bugs.php.net/bug.php?id=65489 ).
> > However not sure if it's so big issue as no one should ever use
> > open_basedir in security context anyway... :)
>
> The biggest problem with glob() was not security but the fact that it
> returned false on non-existing files when open_basedir is set, even when
> everything is inside open_basedir context. Ideally, glob() should return
> the same with and without open_basedir, with added restriction that if
> open_basedir disallows access to some dir/file, then this dir/file does
> not exist for the purposes of glob(). I'm not sure though if glob() does
> that right now completely or how hard it would be to fix it, I didn't
> look into it deeper. I just noticed that a very old bug was not fixed in
> 5.4/5.5 by mistake, and this bug makes usage of glob with open_basedir
> very annoying, as you can not use glob() in foreach() anymore.
>

The Pierre's commit is fine. It fixes the problem that you just described.
So well done for backporting it... ;)

However the second commit from Anatol is unrelated to the Pierre's and
doesn't really fix anything. It was probably forgotten there when we all
forgot about that problem... :)

Anyway there are probably more important things than securing open_basedir
that is not secure anyway :)

Cheers

Jakub

--90e6ba6e89b80279000500afe4e9--